A bind mount from the repository is empty on a CasaOS install

My compose file mounted postgres-init/01-create-runtime-role.sh from the repository to create a restricted database role. On a CasaOS install there is no repository. The bind-mounted directory starts out empty, so the role was never created and the app crash-looped with a password authentication failure.

I replaced the mount with a one-shot service, using the PostgreSQL image already in the file, that writes the role SQL into that directory before the database starts. A small detail bit twice: the generated files needed a permissive umask, because PostgreSQL's runtime user could not read the tighter default.

After the fix I checked the thing that mattered, which is that the runtime role still had no DDL privileges.